@foxden-app/foxclaw 0.3.19 → 0.4.1

package/dist/i18n.d.ts

@@ -118,18 +118,27 @@ declare const MESSAGES: {
         readonly status_codex_local_usage_unavailable: "Codex local history: unavailable ({error})";
         readonly status_codex_credits: "Codex credits: {value}";
         readonly status_codex_limit_reached: "Codex limit: {value}";
+        readonly status_runtime_overview: "Telegram bot runtimes:";
+        readonly status_runtime_bot: "- {bot}: connected {connected}, auth {auth}, active turns {turns}";
+        readonly status_runtime_weixin: "- Weixin default runtime: connected {connected}, active turns {turns}";
+        readonly status_auth_mirror_none: "Last auth mirror: none recorded";
+        readonly status_auth_mirror_synced: "Last auth mirror: {candidate} from {source} at {time}";
+        readonly status_last_update_none: "Last service update: none recorded";
+        readonly status_last_update: "Last service update: {from} -> {to} at {time}";
+        readonly status_last_codex_update: "Last Codex update: {value}";
         readonly update_started: "FoxClaw update started. I will report here after installation, checks, and service restart complete.";
         readonly update_succeeded: "FoxClaw updated and restarted: {from} -> {to}.";
         readonly update_failed: "FoxClaw update failed: {error}\nRun foxclaw update in a terminal for details.";
         readonly update_unavailable: "Self-update is unavailable in this runtime. Run foxclaw update in a terminal.";
         readonly update_already_running: "A FoxClaw update is already running. I will report here when it finishes.";
-        readonly update_blocked_active: "Cannot update FoxClaw while a turn, approval, or question is active. Wait or use /interrupt first.";
+        readonly update_blocked_active: "Cannot update FoxClaw while a runtime activity or auth mirror write is active. Wait or use /interrupt first.";
         readonly auth_reload_restarting: "Restarting Codex app-server to reload auth...";
         readonly auth_reload_done: "Codex app-server restarted. Current auth has been reloaded.";
         readonly auth_reload_blocked_active: "Cannot reload Codex auth while a turn, approval, or question is active. Wait or use /interrupt first.";
         readonly usage_auth: "Usage: /auth [list|use <n>|enable <n>|disable <n>|reload|add <name>]";
         readonly usage_auth_add: "Usage: /auth add <name>. Use letters, numbers, dot, dash, or underscore.";
         readonly auth_list_title: "Codex auth files:";
+        readonly auth_bot: "Bot runtime: {value}";
         readonly auth_current: "Current auth: {value}";
         readonly auth_dir: "Auth dir: {value}";
         readonly auth_candidate_count: "Candidates: {value}";
@@ -682,18 +691,27 @@ declare const MESSAGES: {
         readonly status_codex_local_usage_unavailable: "Codex 本地历史：无法获取（{error}）";
         readonly status_codex_credits: "Codex 额度：{value}";
         readonly status_codex_limit_reached: "Codex 限制：{value}";
+        readonly status_runtime_overview: "Telegram bot 运行时：";
+        readonly status_runtime_bot: "- {bot}：连接 {connected}，auth {auth}，进行中回复 {turns}";
+        readonly status_runtime_weixin: "- 微信默认运行时：连接 {connected}，进行中回复 {turns}";
+        readonly status_auth_mirror_none: "最近 auth 镜像：暂无记录";
+        readonly status_auth_mirror_synced: "最近 auth 镜像：{candidate} 由 {source} 于 {time} 同步";
+        readonly status_last_update_none: "最近服务升级：暂无记录";
+        readonly status_last_update: "最近服务升级：{from} -> {to}（{time}）";
+        readonly status_last_codex_update: "最近 Codex 升级：{value}";
         readonly update_started: "已开始升级 FoxClaw。安装、自检和服务重启完成后，我会在这里回报结果。";
         readonly update_succeeded: "FoxClaw 已升级并重启：{from} -> {to}。";
         readonly update_failed: "FoxClaw 升级失败：{error}\n请在终端运行 foxclaw update 查看详情。";
         readonly update_unavailable: "当前运行方式不支持自升级，请在终端运行 foxclaw update。";
         readonly update_already_running: "FoxClaw 升级已经在进行中，结束后我会在这里回报结果。";
-        readonly update_blocked_active: "当前有回复、审批或问题在进行中，不能升级 FoxClaw。请先等待，或使用 /interrupt。";
+        readonly update_blocked_active: "当前有 runtime 操作或 auth 镜像写入在进行中，不能升级 FoxClaw。请先等待，或使用 /interrupt。";
         readonly auth_reload_restarting: "正在重启 Codex app-server 以重新读取 auth...";
         readonly auth_reload_done: "Codex app-server 已重启，当前 auth 已重新读取。";
         readonly auth_reload_blocked_active: "当前有回复、审批或问题在进行中，不能重载 Codex auth。请先等待，或使用 /interrupt。";
         readonly usage_auth: "用法：/auth [list|use <编号>|enable <编号>|disable <编号>|reload|add <名称>]";
         readonly usage_auth_add: "用法：/auth add <名称>。名称只能包含字母、数字、点、短横线或下划线。";
         readonly auth_list_title: "Codex auth 文件：";
+        readonly auth_bot: "Bot runtime：{value}";
         readonly auth_current: "当前 auth：{value}";
         readonly auth_dir: "Auth 目录：{value}";
         readonly auth_candidate_count: "候选数量：{value}";

package/dist/i18n.js

@@ -116,18 +116,27 @@ const MESSAGES = {
         status_codex_local_usage_unavailable: 'Codex local history: unavailable ({error})',
         status_codex_credits: 'Codex credits: {value}',
         status_codex_limit_reached: 'Codex limit: {value}',
+        status_runtime_overview: 'Telegram bot runtimes:',
+        status_runtime_bot: '- {bot}: connected {connected}, auth {auth}, active turns {turns}',
+        status_runtime_weixin: '- Weixin default runtime: connected {connected}, active turns {turns}',
+        status_auth_mirror_none: 'Last auth mirror: none recorded',
+        status_auth_mirror_synced: 'Last auth mirror: {candidate} from {source} at {time}',
+        status_last_update_none: 'Last service update: none recorded',
+        status_last_update: 'Last service update: {from} -> {to} at {time}',
+        status_last_codex_update: 'Last Codex update: {value}',
         update_started: 'FoxClaw update started. I will report here after installation, checks, and service restart complete.',
         update_succeeded: 'FoxClaw updated and restarted: {from} -> {to}.',
         update_failed: 'FoxClaw update failed: {error}\nRun foxclaw update in a terminal for details.',
         update_unavailable: 'Self-update is unavailable in this runtime. Run foxclaw update in a terminal.',
         update_already_running: 'A FoxClaw update is already running. I will report here when it finishes.',
-        update_blocked_active: 'Cannot update FoxClaw while a turn, approval, or question is active. Wait or use /interrupt first.',
+        update_blocked_active: 'Cannot update FoxClaw while a runtime activity or auth mirror write is active. Wait or use /interrupt first.',
         auth_reload_restarting: 'Restarting Codex app-server to reload auth...',
         auth_reload_done: 'Codex app-server restarted. Current auth has been reloaded.',
         auth_reload_blocked_active: 'Cannot reload Codex auth while a turn, approval, or question is active. Wait or use /interrupt first.',
         usage_auth: 'Usage: /auth [list|use <n>|enable <n>|disable <n>|reload|add <name>]',
         usage_auth_add: 'Usage: /auth add <name>. Use letters, numbers, dot, dash, or underscore.',
         auth_list_title: 'Codex auth files:',
+        auth_bot: 'Bot runtime: {value}',
         auth_current: 'Current auth: {value}',
         auth_dir: 'Auth dir: {value}',
         auth_candidate_count: 'Candidates: {value}',
@@ -680,18 +689,27 @@ const MESSAGES = {
         status_codex_local_usage_unavailable: 'Codex 本地历史：无法获取（{error}）',
         status_codex_credits: 'Codex 额度：{value}',
         status_codex_limit_reached: 'Codex 限制：{value}',
+        status_runtime_overview: 'Telegram bot 运行时：',
+        status_runtime_bot: '- {bot}：连接 {connected}，auth {auth}，进行中回复 {turns}',
+        status_runtime_weixin: '- 微信默认运行时：连接 {connected}，进行中回复 {turns}',
+        status_auth_mirror_none: '最近 auth 镜像：暂无记录',
+        status_auth_mirror_synced: '最近 auth 镜像：{candidate} 由 {source} 于 {time} 同步',
+        status_last_update_none: '最近服务升级：暂无记录',
+        status_last_update: '最近服务升级：{from} -> {to}（{time}）',
+        status_last_codex_update: '最近 Codex 升级：{value}',
         update_started: '已开始升级 FoxClaw。安装、自检和服务重启完成后，我会在这里回报结果。',
         update_succeeded: 'FoxClaw 已升级并重启：{from} -> {to}。',
         update_failed: 'FoxClaw 升级失败：{error}\n请在终端运行 foxclaw update 查看详情。',
         update_unavailable: '当前运行方式不支持自升级，请在终端运行 foxclaw update。',
         update_already_running: 'FoxClaw 升级已经在进行中，结束后我会在这里回报结果。',
-        update_blocked_active: '当前有回复、审批或问题在进行中，不能升级 FoxClaw。请先等待，或使用 /interrupt。',
+        update_blocked_active: '当前有 runtime 操作或 auth 镜像写入在进行中，不能升级 FoxClaw。请先等待，或使用 /interrupt。',
         auth_reload_restarting: '正在重启 Codex app-server 以重新读取 auth...',
         auth_reload_done: 'Codex app-server 已重启，当前 auth 已重新读取。',
         auth_reload_blocked_active: '当前有回复、审批或问题在进行中，不能重载 Codex auth。请先等待，或使用 /interrupt。',
         usage_auth: '用法：/auth [list|use <编号>|enable <编号>|disable <编号>|reload|add <名称>]',
         usage_auth_add: '用法：/auth add <名称>。名称只能包含字母、数字、点、短横线或下划线。',
         auth_list_title: 'Codex auth 文件：',
+        auth_bot: 'Bot runtime：{value}',
         auth_current: '当前 auth：{value}',
         auth_dir: 'Auth 目录：{value}',
         auth_candidate_count: '候选数量：{value}',

package/dist/main.js

@@ -10,7 +10,7 @@ import { APP_HOME, DEFAULT_CODEX_TELEGRAM_HOME, DEFAULT_ENV_PATH, DEFAULT_LOG_PA
 import { acquireProcessLock, LockHeldError } from './lock.js';
 import { readRuntimeStatus, writeRuntimeStatus } from './runtime.js';
 import { refreshFoxclawExecStartDropIns, removeFoxclawExecStartDropIns } from './systemd.js';
-import { createSelfUpdateRuntime, inferPnpmHomeFromEntryPoint, performSelfUpdate } from './update.js';
+import { createSelfUpdateRuntime, inferPnpmHomeFromEntryPoint, performSelfUpdate, readSelfUpdateStatus, writeSelfUpdateStatus, } from './update.js';
 const rawCommand = process.argv[2];
 const command = rawCommand || 'serve';
 loadEnv();
@@ -162,6 +162,7 @@ async function runServeCli() {
     const processLock = acquireProcessLock(config.lockPath);
     let store = null;
     let weixinAdapter = null;
+    let activeWeixinCore = null;
     let activeTelegramAdapters = [];
     let managedApps = [];
     let activeAuthMirror = null;
@@ -184,23 +185,26 @@ async function runServeCli() {
                     tgScopeBotId: id,
                     codexAuthDir: home,
                     codexHome: home,
+                    codexAppAutolaunch: false,
                     codexAppServerStatePath: path.join(APP_HOME, 'runtime', `codex-app-server-${id}.json`),
                     codexAppServerLogPath: path.join(APP_HOME, 'logs', `codex-app-server-${id}.log`),
                 };
-                const app = new CodexAppClient(runtimeConfig.codexCliBin, runtimeConfig.codexAppLaunchCmd, runtimeConfig.codexAppAutolaunch, runtimeConfig.codexAppServerStatePath, runtimeConfig.codexAppServerLogPath, logger, { CODEX_HOME: home });
+                const app = new CodexAppClient(runtimeConfig.codexCliBin, runtimeConfig.codexAppLaunchCmd, runtimeConfig.codexAppAutolaunch, runtimeConfig.codexAppServerStatePath, runtimeConfig.codexAppServerLogPath, logger, { CODEX_HOME: home }, ['cli_auth_credentials_store="file"']);
                 seeds.push({ id, home, config: runtimeConfig, bot, app });
             }
             const canonicalAuthDir = config.codexAuthDir ?? config.codexHome ?? path.join(os.homedir(), '.codex');
             const mirror = new AuthCandidateMirror(canonicalAuthDir, seeds.map((runtime) => ({
                 id: runtime.id,
+                label: runtime.bot.username ? `@${runtime.bot.username}` : runtime.id,
                 authDir: runtime.home,
+                validate: async (context) => validateRefreshedAuthCandidate(runtime, context.candidateName),
                 notify: async (message) => {
                     const chatId = store.getTelegramPrivateChatId(runtime.id);
                     if (chatId) {
                         await runtime.bot.sendMessage(chatId, message);
                     }
                 },
-            })), logger);
+            })), logger, path.join(APP_HOME, 'runtime', 'auth-mirror.json'));
             await mirror.initialize();
             mirror.start();
             activeAuthMirror = mirror;
@@ -213,21 +217,29 @@ async function runServeCli() {
                 logPath: path.join(APP_HOME, 'logs', 'update.log'),
                 codexCliBin: config.codexCliBin,
             });
+            const lastSelfUpdatePath = path.join(APP_HOME, 'runtime', 'last-self-update.json');
+            let lastSelfUpdate = readSelfUpdateStatus(lastSelfUpdatePath);
             const runtimes = [];
             const writeAggregateStatus = (running = true) => {
                 const statuses = runtimes.map((runtime) => runtime.core.getRuntimeStatus());
+                const weixinStatus = activeWeixinCore?.getRuntimeStatus() ?? null;
                 const first = statuses[0] ?? null;
                 writeRuntimeStatus(config.statusPath, {
                     running,
-                    connected: running && statuses.every((status) => status.connected),
+                    connected: running
+                        && statuses.every((status) => status.connected)
+                        && (!weixinStatus || weixinStatus.connected),
                     userAgent: first?.userAgent ?? null,
                     ...(first?.codexAppServer ? { codexAppServer: first.codexAppServer } : {}),
                     botUsername: first?.botUsername ?? null,
                     currentBindings: store.countBindings(),
                     pendingApprovals: store.countPendingApprovals(),
                     pendingUserInputs: store.countPendingUserInputs(),
-                    activeTurns: statuses.reduce((sum, status) => sum + status.activeTurns, 0),
-                    lastError: statuses.find((status) => status.lastError)?.lastError ?? null,
+                    activeTurns: statuses.reduce((sum, status) => sum + status.activeTurns, 0)
+                        + (weixinStatus?.activeTurns ?? 0),
+                    lastError: statuses.find((status) => status.lastError)?.lastError
+                        ?? weixinStatus?.lastError
+                        ?? null,
                     updatedAt: new Date().toISOString(),
                     channels: { telegram: running, weixin: running && config.wxEnabled },
                     bots: runtimes.map((runtime, index) => ({
@@ -237,24 +249,63 @@ async function runServeCli() {
                         activeTurns: running ? (statuses[index]?.activeTurns ?? 0) : 0,
                         ...(statuses[index]?.codexAppServer ? { codexAppServer: statuses[index].codexAppServer } : {}),
                     })),
+                    ...(weixinStatus ? {
+                        weixinRuntime: {
+                            connected: running && weixinStatus.connected,
+                            activeTurns: running ? weixinStatus.activeTurns : 0,
+                            ...(weixinStatus.codexAppServer ? { codexAppServer: weixinStatus.codexAppServer } : {}),
+                        },
+                    } : {}),
+                    authMirror: mirror.getStatus(),
+                    lastUpdate: lastSelfUpdate,
                 });
             };
             const coordinator = {
-                canSelfUpdate: () => runtimes.every((runtime) => runtime.core.isIdleForServiceUpdate()),
+                canSelfUpdate: () => runtimes.every((runtime) => runtime.core.isIdleForServiceUpdate())
+                    && (!activeWeixinCore || activeWeixinCore.isIdleForServiceUpdate())
+                    && mirror.isIdle(),
                 authCandidateUpdated: (runtimeId, candidateName) => mirror.syncRuntimeCandidate(runtimeId, candidateName).then(() => undefined),
                 statusUpdated: () => writeAggregateStatus(),
+                getServiceStatus: async () => ({
+                    bots: await Promise.all(runtimes.map(async (runtime) => {
+                        const status = runtime.core.getRuntimeStatus();
+                        return {
+                            id: runtime.id,
+                            username: status.botUsername ?? runtime.bot.username,
+                            connected: status.connected,
+                            activeTurns: status.activeTurns,
+                            currentAuth: await runtime.core.getCurrentAuthLabel().catch(() => null),
+                            ...(status.codexAppServer ? { codexAppServer: status.codexAppServer } : {}),
+                        };
+                    })),
+                    ...(activeWeixinCore ? {
+                        weixinRuntime: {
+                            connected: activeWeixinCore.getRuntimeStatus().connected,
+                            activeTurns: activeWeixinCore.getRuntimeStatus().activeTurns,
+                            codexAppServer: activeWeixinCore.getRuntimeStatus().codexAppServer,
+                        },
+                    } : {}),
+                    authMirror: mirror.getStatus(),
+                    lastUpdate: lastSelfUpdate,
+                }),
+                selfUpdateCompleted: (status) => {
+                    lastSelfUpdate = status;
+                    writeSelfUpdateStatus(lastSelfUpdatePath, status);
+                    writeAggregateStatus();
+                },
             };
-            for (const [index, seed] of seeds.entries()) {
+            for (const seed of seeds) {
                 const telegramMessaging = new TelegramMessagingPort(seed.bot);
-                const weixinMessaging = index === 0 && config.wxEnabled
-                    ? new WeixinMessagingPort(store, (id) => loadWeixinAccount(config.weixinAccountsDir, id))
-                    : null;
-                const outbound = new BridgeMessagingRouter(telegramMessaging, weixinMessaging);
+                const outbound = new BridgeMessagingRouter(telegramMessaging, null);
                 const core = new BridgeSessionCore(seed.config, store, logger, seed.bot, seed.app, outbound, selfUpdater, coordinator);
                 runtimes.push({ ...seed, core, telegram: new TelegramChannelAdapter(core) });
             }
             if (config.wxEnabled) {
-                weixinAdapter = new WeixinChannelAdapter(runtimes[0].core, store, runtimes[0].config, logger);
+                const weixinApp = new CodexAppClient(config.codexCliBin, config.codexAppLaunchCmd, config.codexAppAutolaunch, config.codexAppServerStatePath, config.codexAppServerLogPath, logger);
+                const outbound = new BridgeMessagingRouter(new TelegramMessagingPort(seeds[0].bot), new WeixinMessagingPort(store, (id) => loadWeixinAccount(config.weixinAccountsDir, id)));
+                activeWeixinCore = new BridgeSessionCore(config, store, logger, seeds[0].bot, weixinApp, outbound, selfUpdater, coordinator, false);
+                managedApps.push(weixinApp);
+                weixinAdapter = new WeixinChannelAdapter(activeWeixinCore, store, config, logger);
             }
             activeTelegramAdapters = runtimes.map((runtime) => runtime.telegram);
             process.on('unhandledRejection', (error) => {
@@ -267,6 +318,7 @@ async function runServeCli() {
                 await runtime.telegram.start();
             }
             if (weixinAdapter) {
+                await activeWeixinCore.startCodexApp();
                 await weixinAdapter.start();
             }
             writeAggregateStatus();
@@ -275,10 +327,11 @@ async function runServeCli() {
                 logger.info('bridge.shutting_down', { signal });
                 mirror.stop();
                 await weixinAdapter?.stop();
+                await activeWeixinCore?.stop();
                 await Promise.all(runtimes.map((runtime) => runtime.telegram.stop()));
                 writeAggregateStatus(false);
-                await Promise.all(runtimes.map((runtime) => runtime.app.stop({ terminateServer: true }).catch((error) => {
-                    logger.warn('codex.app-server.stop_failed', { runtimeId: runtime.id, error: serializeError(error) });
+                await Promise.all(managedApps.map((app) => app.stop({ terminateServer: true }).catch((error) => {
+                    logger.warn('codex.app-server.stop_failed', { error: serializeError(error) });
                 })));
                 store?.close();
                 processLock.release();
@@ -352,6 +405,7 @@ async function runServeCli() {
     catch (error) {
         activeAuthMirror?.stop();
         await weixinAdapter?.stop().catch(() => { });
+        await activeWeixinCore?.stop().catch(() => { });
         await Promise.allSettled(activeTelegramAdapters.map((adapter) => adapter.stop()));
         await Promise.allSettled(managedApps.map((app) => app.stop({ terminateServer: true })));
         store?.close();
@@ -359,6 +413,26 @@ async function runServeCli() {
         throw error;
     }
 }
+async function validateRefreshedAuthCandidate(runtime, candidateName) {
+    const authPath = path.join(runtime.home, 'auth.json');
+    const candidatePath = path.join(runtime.home, candidateName);
+    const [currentTarget, candidateTarget] = await Promise.all([
+        fs.promises.realpath(authPath).catch(() => null),
+        fs.promises.realpath(candidatePath).catch(() => null),
+    ]);
+    if (!currentTarget || !candidateTarget || currentTarget !== candidateTarget) {
+        return { ok: false, reason: 'candidate is not the current auth target' };
+    }
+    if (!runtime.app.isConnected()) {
+        return { ok: false, reason: 'source app-server is not connected' };
+    }
+    const account = await runtime.app.readAccount();
+    if (!account || account.type !== 'chatgpt' || account.requiresOpenaiAuth) {
+        return { ok: false, reason: 'source app-server did not report an active ChatGPT account' };
+    }
+    await runtime.app.readAccountRateLimits();
+    return { ok: true };
+}
 async function initConfig() {
     const envPath = process.env.FOXCLAW_ENV?.trim() || DEFAULT_ENV_PATH;
     fs.mkdirSync(path.dirname(envPath), { recursive: true });

package/dist/types.d.ts

@@ -345,6 +345,25 @@ export interface RuntimeStatus {
         username: string | null;
         connected: boolean;
         activeTurns: number;
+        currentAuth?: string | null;
         codexAppServer?: RuntimeStatus['codexAppServer'];
     }>;
+    weixinRuntime?: {
+        connected: boolean;
+        activeTurns: number;
+        codexAppServer?: RuntimeStatus['codexAppServer'];
+    };
+    authMirror?: {
+        candidateName: string;
+        sourceRuntimeId: string;
+        sourceLabel: string;
+        syncedAt: string;
+    } | null;
+    lastUpdate?: {
+        state: string;
+        fromVersion: string;
+        toVersion: string | null;
+        codexUpdate?: string | null;
+        updatedAt: string;
+    } | null;
 }

package/docs/agent-assisted-install.md

@@ -17,7 +17,7 @@ Optional later:
 - `TG_ALLOWED_CHAT_ID`
 - `TG_ALLOWED_TOPIC_ID`
 
-Use private Telegram chat first. Configure groups/topics only after private chat works.
+Use private Telegram chat first. Configure groups/topics only after private chat works. Multiple tokens mean independent Codex runtimes inside one service; validate each bot privately.
 
 ## Copy-Paste Prompt
 
@@ -45,11 +45,12 @@ Tasks:
 5. Run foxclaw init, then write ~/.foxclaw/.env. Never print or commit the bot token.
 6. Run foxclaw doctor.
 7. Start FoxClaw with foxclaw start.
-8. Ask me to send /help and /status to the Telegram bot.
+8. Ask me to send /help, /status, and /auth privately to each configured Telegram bot; confirm /auth names that bot runtime.
 9. Verify the final state:
    - foxclaw.service is active/enabled on Linux
    - foxclaw status works
 10. Report the commands used, the final status, and the log command I should use if something stops working. Redact TG_BOT_TOKENS and never print the full token or full .env content.
+11. If multiple bots are enabled, confirm foxclaw status lists independent app-servers; group-chat tests must mention or reply to the intended bot.
 ```
 
 ## Safety Notes

package/docs/install-for-beginners.md

@@ -123,7 +123,7 @@ npm install -g @foxden-app/foxclaw
 foxclaw init
 ```
 
-This creates the config file at `~/.foxclaw/.env` and prompts for the Telegram bot token, your numeric Telegram user id, and the default workspace.
+This creates the config file at `~/.foxclaw/.env` and prompts for one or more comma-separated Telegram bot tokens, your numeric Telegram user id, and the default workspace. New installs use `TG_BOT_TOKENS`; legacy `TG_BOT_TOKEN` is only for existing single-bot configurations.
 
 If you prefer pnpm:
 
@@ -154,6 +154,14 @@ DEFAULT_SANDBOX_MODE=workspace-write
 
 Keep `TG_ALLOWED_CHAT_ID=` and `TG_ALLOWED_TOPIC_ID=` empty for the first install. Do not delete those lines; leaving them empty means private-chat mode.
 
+Start with one bot. To add three independent Codex lanes later, put the tokens on the same line:
+
+```dotenv
+TG_BOT_TOKENS=123456789:token_a,234567890:token_b,345678901:token_c
+```
+
+FoxClaw still installs one service, but each bot receives its own app-server, session home, and current auth selection. After startup, privately send `/help` and `/status` to each bot.
+
 `DEFAULT_CWD` must be a real folder. Examples:
 
 ```dotenv
@@ -280,7 +288,7 @@ Update FoxClaw later:
 foxclaw update
 ```
 
-You can also send `/update` in an authorized Telegram chat. When every bot is idle with no approval or question active, it attempts to update an npm/pnpm-managed Codex CLI, upgrades FoxClaw, checks, restarts the service, and reports the result after restart.
+You can also send `/update` in an authorized Telegram chat. When every Telegram bot runtime, an enabled Weixin default runtime, and auth mirror writes are idle, it attempts to update an npm/pnpm-managed Codex CLI, upgrades FoxClaw, checks, restarts the service, and reports the result through the bot that started it.
 
 ## Next Step
 

package/docs/troubleshooting.md

@@ -182,6 +182,18 @@ Bridge logs are stored here:
 tail -f ~/.foxclaw/logs/service.log
 ```
 
+## Checking Multi-Bot Mode
+
+After configuring `TG_BOT_TOKENS`, `foxclaw status` should contain one bot id, connection status, and independent app-server for each token. Send `/status` privately to any bot to see the runtime summary; send `/auth` to confirm the panel names the current `@botname` and its auth directory.
+
+Each isolated app-server log is stored at:
+
+```bash
+tail -f ~/.foxclaw/logs/codex-app-server-bot<id>.log
+```
+
+When multiple bots share a group, unaddressed messages intentionally do not trigger them; mention `@botname`, reply to the intended bot, or send `/status@botname`. When enabled, Weixin stays on the default Codex runtime and does not appear inside an isolated Telegram bot's thread list.
+
 ## ChatGPT Backend 403 Or Unable To Load Site
 
 If Telegram shows `ChatGPT backend 403 Forbidden`, or the app-server log contains `Unable to load site`, `cf-ray`, or `chatgpt.com/backend-api`, the auth file is not necessarily broken. The service process is usually reaching ChatGPT with the wrong network/proxy/IP.

package/docs/user-manual.md

@@ -230,10 +230,10 @@ Later commands are sorted by recent usage. Plain text, photos, and files continu
 
 ### 3.2 `/status`, `/account`, `/quota`, `/update`
 
-- `/status`: FoxClaw, app-server, current thread binding, model, access, and Codex usage summary. Local session, token, and visible-reply-throughput metrics use a background-generated historical snapshot instead of scanning large logs during the request; throughput is computed end-to-end for completed turns, excluding reasoning tokens while including waiting and tool execution time.
+- `/status`: FoxClaw, app-server, current thread binding, model, access, and Codex usage summary. In multi-bot mode it also lists every bot's connection, current auth, active turns, and the most recent auth mirror and service/Codex update outcomes. Local session, token, and visible-reply-throughput metrics use a background-generated historical snapshot instead of scanning large logs during the request; throughput is computed end-to-end for completed turns, excluding reasoning tokens while including waiting and tool execution time.
 - `/account`: current Codex account.
 - `/quota`: Codex usage and quota window.
-- `/update`: upgrade FoxClaw, attempt to update an npm/pnpm-managed Codex CLI, run checks, and restart the service; it refuses while any bot runtime has a turn, approval, or question active, then reports the result after restart.
+- `/update`: upgrade FoxClaw, attempt to update an npm/pnpm-managed Codex CLI, run checks, and restart the service; it refuses while any Telegram bot runtime, an enabled Weixin default runtime, or an auth mirror write is busy, then reports the result through the initiating bot after restart.
 
 ### 3.3 `/config`, `/requirements`, `/provider`
 
@@ -335,7 +335,7 @@ Watch mode mirrors live turn progress and approval requests. The watching chat i
 
 ## 6. Codex Login And Auth Rotation
 
-This is a key FoxClaw feature. Codex auth is usually stored at `~/.codex/auth.json`. FoxClaw stores multiple accounts as candidate files and switches which candidate the active `auth.json` points to. In `TG_BOT_TOKENS` mode, each bot has an isolated Codex home, app-server, and current candidate, so bots can run and switch accounts independently; validated login/refresh credentials are safely mirrored between bot homes.
+This is a key FoxClaw feature. Codex auth is usually stored at `~/.codex/auth.json`. FoxClaw stores multiple accounts as candidate files and switches which candidate the active `auth.json` points to. In `TG_BOT_TOKENS` mode, each bot has an isolated Codex home, app-server, and current candidate, so bots can run and switch accounts independently; isolated Telegram runtimes force file-backed credential storage. Validated login/refresh credentials are safely mirrored between bot homes, but sessions are never shared.
 
 ### 6.1 File Format
 
@@ -387,7 +387,7 @@ If the login is cancelled or fails, FoxClaw tries to restore the previous auth t
 
 ### 6.3 The `/auth` Panel
 
-`/auth` lists candidate accounts, the current account, and the auth directory. It also provides buttons for switching, disabling, login, and reload. The `5h|7d` numbers before each filename are the last recorded remaining percentages for the two quota windows; the current auth is refreshed when the panel opens, while other candidates are not switched merely to query quota.
+`/auth` lists candidate accounts, the current account, and the auth directory. It also provides buttons for switching, disabling, login, and reload. In multi-bot mode the panel names the `@botname` runtime being managed, because private chats, groups, and topics on one bot share that bot's current auth. The `5h|7d` numbers before each filename are the last recorded remaining percentages for the two quota windows; the current auth is refreshed when the panel opens, while other candidates are not switched merely to query quota.
 
 Approximation:
 

package/docs/zh/agent-assisted-install.md

@@ -17,7 +17,7 @@
 - `TG_ALLOWED_CHAT_ID`
 - `TG_ALLOWED_TOPIC_ID`
 
-第一次请先用 Telegram 私聊跑通。群组和话题模式等私聊稳定后再开。
+第一次请先用 Telegram 私聊跑通。群组和话题模式等私聊稳定后再开。多个 token 表示同一服务内多个独立 Codex runtime；每个 bot 都必须单独完成私聊验收。
 
 ## 复制给 agent 的安装提示词
 
@@ -44,11 +44,12 @@ DEFAULT_CWD=<把绝对工作目录粘贴在这里>
 5. 运行 foxclaw init，然后写入 ~/.foxclaw/.env。不要打印或提交 bot token。
 6. 运行 foxclaw doctor。
 7. 用 foxclaw start 启动 FoxClaw。
-8. 让我在 Telegram bot 里发送 /help 和 /status。
+8. 让我在每个已配置的 Telegram bot 私聊里发送 /help、/status 和 /auth；确认 /auth 显示对应 bot runtime。
 9. 验证最终状态：
    - Linux 上 foxclaw.service 处于 active/enabled
    - foxclaw status 可以正常输出
 10. 汇报执行过的命令、最终状态和后续看日志的命令。请隐藏 TG_BOT_TOKENS，不要打印完整 token 或完整 .env。
+11. 如果启用了多个 bot，确认 foxclaw status 列出独立 app-server；群聊测试必须点名或回复目标 bot。
 ```
 
 ## 安全注意事项

package/docs/zh/foxclaw-skill.md

@@ -14,11 +14,13 @@
 2. 让 Codex 使用 `skills/foxclaw`。
 3. 如果是远程机器，提供 SSH 目标。
 4. 让 Codex 执行安装、写配置、跑 `foxclaw doctor`。
-5. 启动服务后，在 Telegram bot 里发送 `/help` 和 `/status` 验证。
+5. 启动服务后，在每个配置的 Telegram bot 私聊里发送 `/help`、`/status` 和 `/auth` 验证。
 
 ## 注意事项
 
 - 不要让 agent 把完整 bot token 打印到日志或提交到仓库。
 - 第一次请先用私聊模式跑通。
+- 多个 token 会在同一服务中建立多个独立 Codex home、session 与 auth 选择；群组中必须点名或回复目标 bot。
+- 同时启用微信时，微信仍使用默认 Codex runtime，不共享隔离 Telegram bot 的线程。
 - 不要把整个 home 目录或根目录作为首次 `DEFAULT_CWD`。
 - 只有在 `doctor` 通过、服务已启动、Telegram 首条消息验证通过后，才算安装完成。

package/docs/zh/install-for-beginners.md

@@ -121,7 +121,7 @@ npm install -g @foxden-app/foxclaw
 foxclaw init
 ```
 
-这会创建默认配置文件 `~/.foxclaw/.env`，并提示你填写 Telegram bot token、Telegram 数字用户 ID 和默认工作目录。
+这会创建默认配置文件 `~/.foxclaw/.env`，并提示你填写一个或多个 Telegram bot token（多个用英文逗号分隔）、Telegram 数字用户 ID 和默认工作目录。新安装使用 `TG_BOT_TOKENS`；旧的 `TG_BOT_TOKEN` 仅用于兼容已有单 bot 配置。
 
 如果你用 pnpm：
 
@@ -152,6 +152,14 @@ DEFAULT_SANDBOX_MODE=workspace-write
 
 `TG_ALLOWED_CHAT_ID=` 和 `TG_ALLOWED_TOPIC_ID=` 第一次保持为空，不要删掉这两行；留空表示私聊模式。
 
+只有一个 bot 时先按上面的配置跑通即可。需要三条互不打断的 Codex 会话时，把多个 token 写在同一行：
+
+```dotenv
+TG_BOT_TOKENS=123456789:token_a,234567890:token_b,345678901:token_c
+```
+
+FoxClaw 仍只安装一个服务，但每个 bot 会有独立 app-server、会话目录和当前 auth。服务启动后请分别私聊每个 bot 发送 `/help` 与 `/status`。
+
 `DEFAULT_CWD` 必须是真实存在的目录，例如：
 
 ```dotenv
@@ -278,7 +286,7 @@ foxclaw uninstall-systemd
 foxclaw update
 ```
 
-也可以在已授权的 Telegram 私聊里发送 `/update`。它会在所有 bot 都没有运行中回复、审批或待确认问题时，尝试升级 npm/pnpm 安装的 Codex CLI，完成 FoxClaw 升级、自检和服务重启，并在重启后回报结果。
+也可以在已授权的 Telegram 私聊里发送 `/update`。它会在所有 Telegram bot、已启用的微信默认 runtime 和 auth 镜像写入都空闲时，尝试升级 npm/pnpm 安装的 Codex CLI，完成 FoxClaw 升级、自检和服务重启，并在发起命令的 bot 中回报结果。
 
 如果 `~/.foxclaw/.env` 已经存在，`foxclaw init` 会先询问是否更新 Telegram 和工作目录相关字段，其它配置保持不变。
 

package/docs/zh/troubleshooting.md

@@ -183,6 +183,18 @@ Bridge 日志默认在：
 tail -f ~/.foxclaw/logs/service.log
 ```
 
+## 多 bot 模式核查
+
+配置 `TG_BOT_TOKENS` 后，`foxclaw status` 的 `bots` 列表应为每个 token 显示一个 bot id、连接状态和独立 app-server。私聊任一 bot 发送 `/status` 会显示全部 runtime 摘要；发送 `/auth` 应显示当前 `@botname` 和该 bot 的 auth 目录。
+
+每个隔离 app-server 的日志路径为：
+
+```bash
+tail -f ~/.foxclaw/logs/codex-app-server-bot<id>.log
+```
+
+群组里配置了多个 bot 时，普通未点名消息不会触发它们；使用 `@botname`、回复目标 bot，或 `/status@botname`。微信启用后仍使用默认 Codex runtime，不会出现在某个 Telegram bot 的隔离线程中。
+
 ## ChatGPT 后端 403 或 Unable to load site
 
 如果 Telegram 里看到 `ChatGPT backend 403 Forbidden`，或者 app-server 日志里出现 `Unable to load site`、`cf-ray`、`chatgpt.com/backend-api`，通常不是 `auth.json` 文件坏了，而是服务进程访问 ChatGPT 后端时没有走正确网络。

package/docs/zh/user-manual.md

@@ -230,10 +230,10 @@ TG_ALLOWED_TOPIC_ID=42
 
 ### 3.2 `/status`、`/account`、`/quota`、`/update`
 
-- `/status`：查看 FoxClaw、app-server、当前绑定线程、模型、权限和 Codex 用量摘要。本地 session/Token/可见答复吞吐使用后台生成的历史快照，避免状态查询现场扫描大量日志；答复吞吐按完成轮次端到端耗时计算，排除推理 token，但包含等待与工具执行时间。
+- `/status`：查看 FoxClaw、app-server、当前绑定线程、模型、权限和 Codex 用量摘要。多 bot 模式还会列出所有 bot 的连接、当前 auth、活动 turn，以及最近一次 auth 镜像和服务/Codex 升级结果。本地 session/Token/可见答复吞吐使用后台生成的历史快照，避免状态查询现场扫描大量日志；答复吞吐按完成轮次端到端耗时计算，排除推理 token，但包含等待与工具执行时间。
 - `/account`：查看当前 Codex 登录账号。
 - `/quota`：查看 Codex 用量和额度窗口。
-- `/update`：升级 FoxClaw，并尝试升级 npm/pnpm 安装的 Codex CLI，然后自检和重启服务；任意 bot runtime 有运行中回复、审批或待确认问题时都会拒绝执行，重启后会回报结果。
+- `/update`：升级 FoxClaw，并尝试升级 npm/pnpm 安装的 Codex CLI，然后自检和重启服务；任意 Telegram bot、启用的微信默认 runtime 或 auth 镜像写入不空闲时都会拒绝执行，重启后通过发起命令的 bot 回报结果。
 
 ### 3.3 `/config`、`/requirements`、`/provider`
 
@@ -335,7 +335,7 @@ FoxClaw 的聊天是“绑定线程”的。你在手机上打开某个 Codex
 
 ## 6. Codex 登录和 auth 轮转
 
-这是 FoxClaw 的特色功能。Codex 的登录状态通常保存在 `~/.codex/auth.json`。FoxClaw 把多个账号保存成候选文件，并通过切换 `auth.json` 指向哪个候选来换号。启用 `TG_BOT_TOKENS` 多 bot 模式后，每个 bot 使用独立 Codex home、独立 app-server 和独立当前候选，因此可以并行运行、单独切号；已验证的登录/刷新凭据会安全镜像到其他 bot home。
+这是 FoxClaw 的特色功能。Codex 的登录状态通常保存在 `~/.codex/auth.json`。FoxClaw 把多个账号保存成候选文件，并通过切换 `auth.json` 指向哪个候选来换号。启用 `TG_BOT_TOKENS` 多 bot 模式后，每个 bot 使用独立 Codex home、独立 app-server 和独立当前候选，因此可以并行运行、单独切号；隔离 Telegram runtime 会强制使用文件凭据存储。已验证的登录/刷新凭据会安全镜像到其他 bot home，但不会共享 session。
 
 ### 6.1 文件格式
 
@@ -387,7 +387,7 @@ cp -L ~/.codex/auth.json ~/.codex/auth.json_personal
 
 ### 6.3 `/auth` 面板
 
-`/auth` 会列出候选账号、当前账号和 auth 目录，并提供按钮切换、禁用、登录和重载。每个候选名前的 `5h|7d` 数字表示上次记录到的两个额度窗口剩余百分比；当前 auth 会在打开面板时刷新，其他候选不会为了查询额度被自动切换。
+`/auth` 会列出候选账号、当前账号和 auth 目录，并提供按钮切换、禁用、登录和重载。多 bot 模式中，面板顶部还会显示当前正在管理的 `@botname`，因为该 bot 内的私聊、群聊和话题共享同一个当前 auth。每个候选名前的 `5h|7d` 数字表示上次记录到的两个额度窗口剩余百分比；当前 auth 会在打开面板时刷新，其他候选不会为了查询额度被自动切换。
 
 示意：
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foxden-app/foxclaw",
-  "version": "0.3.19",
+  "version": "0.4.1",
   "description": "Foxden local execution claw for controlling Codex from trusted chat interfaces.",
   "type": "module",
   "main": "dist/main.js",

package/skills/foxclaw/SKILL.md

@@ -65,6 +65,8 @@ Telegram behavior:
 - private chat with `TG_ALLOWED_USER_ID` remains available even when `TG_ALLOWED_CHAT_ID` or `TG_ALLOWED_TOPIC_ID` is set
 - `TG_ALLOWED_CHAT_ID` and `TG_ALLOWED_TOPIC_ID` choose the default group or topic scope; they do not disable private chat
 - when `TG_BOT_TOKENS` contains multiple bots, one FoxClaw service starts independent Codex app-servers and auth selections per bot
+- isolated Telegram runtimes use independent `CODEX_HOME` directories and file-backed credentials; they do not share Codex sessions
+- if Weixin is enabled alongside multiple Telegram bots, it remains on the default Codex runtime instead of borrowing a Telegram bot runtime
 - in a group with multiple configured bots, address a bot by mention, reply, or suffixed command such as `/status@botname`
 
 If `TG_ALLOWED_CHAT_ID` or `TG_ALLOWED_TOPIC_ID` is missing, read [references/telegram-setup.md](./references/telegram-setup.md) and explicitly guide the user through collecting it.
@@ -142,7 +144,8 @@ After either bootstrap path:
    - `privacy mode` is disabled
    - the bot is an admin in the group
    - the configured `TG_ALLOWED_CHAT_ID` and `TG_ALLOWED_TOPIC_ID` match the target group/topic
-5. If group or topic mode is enabled, also verify that private chat still responds for the configured `TG_ALLOWED_USER_ID`.
+5. If group or topic mode is enabled, also verify that private chat still responds for the configured `TG_ALLOWED_USER_ID`.
+6. With multiple bots, send `/status` and `/auth` privately to each bot; verify the status lists each app-server and the auth panel names the intended bot runtime.
 
 ## First Telegram Message Check
 
@@ -192,7 +195,7 @@ Use this checklist when the user asks for standard closing actions, release wrap
    - For macOS launchd, use the launchd install/start path from this skill and verify with `node dist/main.js status`.
    - Verify the running service reports the expected FoxClaw version in `status`.
    - If `doctor` fails only because `DEFAULT_CWD` is missing, report that separately; do not treat it as evidence that the service update failed.
-   - `/update` now attempts to update globally npm/pnpm-managed Codex CLI installations and refuses to restart while any configured bot runtime is busy.
+   - `/update` now attempts to update globally npm/pnpm-managed Codex CLI installations and refuses to restart while any configured Telegram runtime, enabled Weixin default runtime, or auth mirror write is busy.
 7. Publish to npm when requested:
    - Prefer GitHub Actions trusted publishing via `.github/workflows/publish.yml`: bump and commit the package version, push `main`, then push a matching `v<version>` tag. The tag version must match `package.json`.
    - Treat `workflow_dispatch` only as a retry path from an existing matching release tag; do not manually run publishing from `main`.